CVE-2026-86082: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

An administrator can limit an openAiApi credential to certain domains. The node checked a custom base URL against that list before sending a request, but the model-search route that fills the dropdown skipped the check. A request that set options.baseURL there reached an arbitrary host with the credential attached, including the API key.

The attacker needs an n8n account with low privileges and use-only access to the credential, which is a common sharing mode. They do not need to read the secret directly. The result is a stolen OpenAI key, plus requests from the n8n server to hosts the attacker picks, which is the SSRF part (CWE-918). With the key, they can run up charges or read what the account exposes.

The fix routes every OpenAI call site, including model listing, through one shared allowed-domains check. Teams that share domain-restricted OpenAI credentials with many workflow authors, to control cost or data flow, lost that guarantee on affected versions.

Affected: n8n before 1.123.76; 2.0.0 up to but not including 2.37.7; and 2.38.0 and 2.38.1. You are exposed if you use the OpenAI Chat Model node with domain-restricted openAiApi credentials shared with users you do not fully trust. Check:

n8n --version

Upgrade to n8n 1.123.76, 2.37.7 or 2.38.2, or later.

npm install -g [email protected]

Interim steps from n8n: restrict instance access to fully trusted users, audit domain-restricted openAiApi credentials and revoke use-only shares granted to untrusted users, and rotate any openAiApi secret that may have been exposed while reviewing OpenAI account activity for unexpected usage.

Review OpenAI account usage for calls you did not expect, and check outbound traffic from the n8n server for requests to hosts outside the credential's allowed domains, especially from the model-listing route. In n8n, list who has use-only access to each openAiApi credential. Rotate keys if any untrusted user had access.

Impact

The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain restriction an administrator configured did not hold for every route the node offered. The patch routes every OpenAI call site, including model listing, through one shared allowed-domains check.

Patches

The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit all domain-restricted openAiApi credentials and revoke use-only shares granted to untrusted users.
• Rotate any openAiApi credential secrets that may have been exposed and review downstream OpenAI account activity for unexpected usage.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.